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Abstract 

We further investigate and generalize the approximate privacy model recently 
introduced by Feigenbaum et al. [8j. We explore the privacy properties of 
a natural class of communication protocols that we refer to as 11 dissection 
protocols". Informally, in a dissection protocol the communicating parties 
are restricted to answering questions of the form "is your input between the 
values a and (3 (under a pre-defined order over the possible inputs)?". We 
prove that for a large class of functions, called tiling functions, there always 
exists a dissection protocol that provides a constant average-case privacy ap- 
proximation ratio for uniform or "almost uniform" probability distributions 
over inputs. To establish this result we present an interesting connection 
between the approximate privacy framework and basic concepts in compu- 
tational geometry. We show that such a good privacy approximation ratio 
for tiling functions does not, in general, exist in the worst case. We also dis- 
cuss extensions of the basic setup to more than two parties and to non-tiling 
functions, and provide calculations of privacy approximation ratios for two 
functions of interest. 
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1. Introduction 

Consider the following interaction between two parties, Alice and Bob. 
Each of the two parties, Alice and Bob, holds a private input, Xbob and |/ a i ice 
respectively, not known to the other party. The two parties aim to compute 
a function / of the two private inputs. Alice and Bob alternately query each 
other to make available a small amount of information about their private 
inputs, e.g., an answer to a range query on their private inputs or a few bits 
of their private inputs. This process ends when each of them has seen enough 
information to be able to compute the value of /(^bob, 2/aiice)- The central 
question that is the focus of this paper is: 

Can we design a communication protocol whose execution reveals, 
to both Alice and Bob, as well as to any eavesdropper, as little in- 
formation as possible about the other's private input beyond what 
is necessary to compute the function value! 

Note that there are two conflicting constraints: Alice and Bob need to com- 
municate sufficient information for computing the function value, but would 
prefer not to communicate too much information about their private in- 
puts. This setting can be generalized in an obvious manner to d > 1 par- 
ties party^ party 2 , . . . , party d computing a rf-ary / by querying the parties in 
round-robin order, allowing each party to broadcast information about its 
private input (via a public communication channel). 

Privacy preserving computational models such as the one described above 
have become an important research area due to the increasingly widespread 
usage of sensitive data in networked environments, as evidenced by dis- 
tributed computing applications, game-theoretic settings (e.g., auctions) and 
more. Over the years computer scientists have explored many quantifications 
of privacy in computation. Much of this research focused on designing per- 
fectly privacy-preserving protocols, i.e., protocols whose execution reveals no 
information about the parties' private inputs beyond that implied by the out- 
come of the computation. Unfortunately, perfect privacy is often either im- 
possible, or infeasibly costly to achieve (e.g., requiring impractically extensive 
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communication steps). To overcome this, researchers have also investigated 
various notions of approximate privacy 0, @]. 

In this paper, we adopt the approximate privacy framework of [8] that 
quantifies approximate privacy via the privacy approximation ratios (Pars) 
of protocols for computing a deterministic function of two private inputs. 
Informally, Par captures the objective that an observer of the transcript 
of the entire protocol will not be able to distinguish the real inputs of the 
two communicating parties from as large a set as possible of other inputs. 
To capture this intuition, js|] makes use of the machinery of communication- 
complexity theory to provide a geometric and combinatorial interpretation 
of protocols. [8] formulates both the worst-case and the average-case version 
of Pars and studies the tradeoff between privacy preservation and commu- 
nication complexity for several functions of interest. 

1.1. Motivations from Mechanism Designs 

An original motivation of this line of research, as explained in details in [sj], 
comes from privacy concerns in auction theory in Economics. A traditionally 
desired goal of designing auction mechanisms is to ensure that it is incentive 
compatible, i.e., bidders fare best by letting their truthful bids known. How- 
ever, more recently, another complementary goal that has gained significant 
attention, specially in the context of online auctions, is to preserve privacy of 
the bidders, i.e., bidders reveal as little information as necessary to auction- 
eers for optimal outcomes. To give an example, consider a 2 nd -price Vickrey 
auction of an item via a straightforward protocol in which the price of the 
item is incrementally increased until the winner is determined. However, the 
protocol reveals more information than what is absolutely necessary, namely 
the information about the identity of the winner (with revealing his/her bid) 
together with the bid of the second-highest bidder, and revealing such ad- 
ditional information could put the winner at a disadvantage in the bidding 
process of a similar item in the future since the auctioneer could set a lower 
reserve price. In this paper, we consider a generalized version of the setting 
that captures applications of the above type as well as other applications in 
multi-party computation. 

2. Summary of Our Contributions 

Any investigation of approximate privacy for multi-party computation 
starts by defining how we quantify approximate privacy. In this paper, we use 
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the combinatorial framework of [8] for quantification of approximate privacy 
for two parties via Pars and present its natural extension to three or more 
parties. Often, parties' inputs have a natural ordering, e.g., the private 
input of a party belongs to some range of integers {L, L + 1, . . . , M} (as is 
the case when computing, say, the maximum or minimum of two inputs). 
When designing protocols for such environments, a natural restriction is to 
only allow the protocol to ask each party questions of the form "/s your input 
between the values a and (3 ( under this natural order over possible inputs)?' . We 
refer to this type of protocols as dissection protocols and study the privacy 
properties of this natural class of protocols. We note that the bisection and 
c-bisection protocols for the millionaires problem and other problems in jsj, 
as well as the bisection auction in [9], [loj], all fall within this category of 
protocols. Our findings are summarized below. 

Average- and worst-case Pars for tiling functions for two party 
computation. We first consider a broad class of functions, referred to as 
the tiling functions in the sequel, that encompasses several well-studied func- 
tions (e.g., Vickrey's second-price auctions). Informally, a two- variable tiling 
function is a function whose output space can be viewed as a collection of 
disjoint combinatorial rectangles in the two-dimensional plane, where the 
function has the same value within each rectangle. A first natural question 
for investigation is to classify those tiling functions for which there exists a 
perfectly privacy-preserving dissection protocol. We observe that for every 
Boolean tiling functions (i.e., tiling functions which output binary values) 
this is indeed the case. In contrast, for tiling functions with a range of just 
three values, perfectly privacy-preserving computation is no longer necessar- 
ily possible (even when not restricted to dissection protocols). 

We next turn our attention to Pars. We prove that for every tiling 
function there exists a dissection protocol that achieves a constant Par in 
the average case (that is, when the parties' private values are drawn from an 
uniform or almost uniform probability distribution). To establish this result, 
we make use of results on the binary space partitioning problems studied in 
the computational geometry literature. We complement this positive result 
for dissection protocols with the following negative result: there exist tiling 
functions for which no dissection protocol can achieve a constant Par in the 
worst- case. 

Extensions to non-tiling functions and three-party communication. 

We discuss two extensions of the above results. We explain how our constant 
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average-case Par result for tiling functions can be extended to a family of 
"almost" tiling functions. In addition, we consider the case of more than two 
parties. We show that in this setting it is no longer true that for every tiling 
function there exists a dissection protocol that achieves a constant Par in 
the average case. Namely, we exhibit a three-dimensional tiling function for 
which every dissection protocol exhibits exponential average- and worst-case 
Pars, even when an unlimited number of communication steps is allowed. 

PARs for the set covering and equality functions. |£j presents bounds 
on the average-case and the worst-case Pars of the bisection protocol — a 
special case of dissection protocols — for several functions (Yao's millionaires' 
problem, Vickrey's second-price auction, and others). We analyze the Pars 
of the bisection protocol for two well-studied Boolean functions: the set- 
covering and equality functions; the equality function provides a useful testbed 



for evaluating privacy preserving protocols [3| [Uj, Example 1.21] and set- 
covering type of functions are useful for studying the differences between 
deterministic and non-deterministic communication complexities (ill . Section 
10.4]. We show that, for both functions, the bisection protocol fails to achieve 
good Pars in both the average-case and the worst-case. 

3. Summary of Prior Related Works 

3.1. Privacy-preserving Computation 

Privacy-preserving computation has been the subject of extensive re- 
search and has been approached from information-theoretic 0], cryptographic 



statistical [12J, communication complexity |13|,ll7j, statistical database query [ 
and other perspectives [ll(. Among these, most relevant to our work is the 
approximate privacy framework of Feigenbaum et al. [sj that presents a met- 
ric for quantifying privacy preservation building on the work of Chor and 
Kushilevitz jf| on characterizing perfectly privately computable computa- 



tion and on the work of Kushilevitz [13( on the communication complexity of 



perfectly private computation. The bisection, c-bisection and bounded bisec- 
tion protocols of [8j fall within our category of dissection protocol since we 
allow the input space of each party to be divided into two subsets of arbitrary 
size. There are also some other formulations of perfectly and approximately 
privacy-preserving computation in the literature, but they are inapplicable in 
our context. For example, the differential privacy model (see Q) approaches 
privacy in a different context via adding noise to the result of a database 
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query in such a way as to preserve the privacy of the individual database 
records but still have the result convey nontrivial information, 



3.2. Binary space partition (Bsp) 

Bsps present a way to implement a geometric divide- and- conquer strat- 
egy and is an extremely popular approach in numerous applications such as 
hidden surface removal, ray-tracing, visibility problems, solid geometry, mo- 
tion planning and spatial databases (e.g., see [lfij]). However, to the best of 
our knowledge, a connection between Bsps bounds such as in 
and approximate privacy has not been explored before. 



4. The Model and Basic Definitions 



(maximal) 
monochromatic 
rectangle 
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4-1. Two-party Approximate Privacy Model of |q/ 

We have two parties party x and 
party 2 , each a binary string, x\ and X2 
respectively, which represents a private 
value in some set U m . The common 
goal of the two parties is to compute 
the value f(x\,x 2 ) of a given public- 
knowledge two- variable function /. Be- 
fore a communication protocol P starts, 
each party^ initializes its "set of main- 
tained inputs" W/ n to U m . In one step 
of communication, one party transmits 
a bit indicating in which of two parts of 
its input space its private input lies. The 
other party then updates its set of main- 
tained inputs accordingly. The very last 
information transmitted in the protocol 

P contains the value of f(xi,x 2 ). The final transcript of the protocol (i.e., 
the entire information exchanged) is denoted by s(xi,x 2 ). 

Denoting the domain of outputs by U ont , any function / : U m x U m i— > 
ti oat can be visualized as |W m | x \lA™ \ matrix with entries from U oat in which 
the first dimension represents the possible values of party 1; ordered by some 
permutation III, while the second dimension represents the possible values of 
party 2 , ordered by some permutation Yi 2 , and each entry contains the value 




Figure 1: An illustration of some 
communication- complexity definitions. 
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of / associated with a particular set of inputs from the two parties. This 
matrix will be denoted by Ajj u jj 2 (f), or sometimes simply by A. 



We now present the following definitions from ll|, |8( ; see Fig. [T] for a 
geometric illustration. 

Definition 1 (Regions, partitions). A region of A is any subset of entries 
in A. A partition of A is a collection of disjoint regions in A whose union 
equals to A 

Definition 2 (Rectangles, tilings, refinements). A rectangle in A is a sub- 
matrix of A. A tiling of A is a partition of A into rectangles. A tiling T\ of A 
is a refinement of another tiling T 2 of A if every rectangle in T\ is contained 
in some rectangle in T 2 . 

Definition 3 (Monochromatic, maximal monochromatic and ideal monochro- 
matic partitions). A region R of A is monochromatic if all entries in R are 
of the same value. A monochromatic partition of A is a partition all of 
whose regions are monochromatic. A monochromatic region of A is a max- 
imal monochromatic region if no monochromatic region in A properly con- 
tains it. The ideal monochromatic partition of A is made up of the maximal 
monochromatic regions. 

Definition 4 (Perfect privacy). Protocol P achieves perfect privacy if, for 
every two sets of inputs (xi,x 2 ) and [x' x ,x'^) such that f(xi,x 2 ) = f(x[,x' 2 ), 
it holds that s(xi, x 2 ) = s(x\, x' 2 ). Equivalently, a protocol P for f 
achieves perfectly privacy if the monochromatic tiling induced by P is the 
ideal monochromatic partition of A(f). 

Definition 5 (Worst case and average case Par of a protocol P). Let 
R p (xi,x 2 ) be the monochromatic rectangle containing the cell A{x\, x 2 ) in- 
duced by P, R^Xi, x 2 ) be the monochromatic region containing the cell A(xx,yx) 
in the ideal monochromatic partition of A, and V be a probability distribu- 
tion over the space of inputs. Then P has a worst-case Par of a WOTSt and an 
average case Par of a D under distribution T> provided^ 



\R I {x 1 ,x 2 ) | r^ D , » AR I {x 1 ,x 2 )\ 
aWst = max — — and a v = ) Pr [xi & x 2 \ f— — 

{xi,x 2 )<=U in xU in \R^{Xi,X 2 )\ T> , \R^{Xi,X 2 



The notation Pr[£] denotes the probability of an event £ under distribution T>. 
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Definition 6 (Par for a function). The worst-case (average-case) Par for 
a function f is the minimum, over all protocols P for f, of the worst-case 
(average-case) Par of P. 

Extension to Multi-party Computation. In the multi-party setup, we have d > 
2 parties party 1 , party 2 , . . . , party d computing a rf-ary function / : (U m ) d h- >■ 
U ont . Now, / can be visualized as \lA m \ x • • • x |W in | matrix Au u ...,u d (f) (or, 
sometimes simply by A) with entries from U out in which the i th dimension 
represents the possible values of party j ordered by some permutation Ilj, and 
each entry of A contains the value of / associated with a particular set of 
inputs from the d parties. Then, all the previous definitions can be naturally 
adjusted in the obvious manner, i.e., the input space as a d- dimensional 
space, each party maintains the input partitions of all other d — 1 parties, 
the transcript of the protocol s is a ci-ary function, and rectangles are replaced 
by d- dimensional hyper- rectangles (Cartesian product of d intervals). 

4-2. Dissection Protocols and Tiling Functions for Two-party Computation 
Often in a communication complexity settings the input of each party 
has a natural ordering, e.g., the set of input of a party from {0, l} can 
represent the numbers 0, 1, 2, . . . , 2 k — 1 (as is the case when computing the 
maximum/minimum of two inputs, in the millionaires problem, in second- 
price auctions, and more). When designing protocols for such environments, 
a natural restriction is to only the allow protocols such that each party asks 
questions of the form "Is your input between a and b (in this natural order 

over possible inputs)?", where a,b G {0, l} fc . Notice that after applying 
an appropriate permutation to the inputs, such a protocol divides the input 
space into two (not necessarily equal) halves. Below, we formalize these types 
of protocols as " dissection protocols" . 

Definition 7 (contiguous subset of inputs). Given a permutation U of {0, l} k , 
let -< n denote the total order over{0, l} k thatU induces, i.e., Va, b G {0, l} k , 
a -< n b provided b comes after a in II. Then, I C {0, l} k contiguous with 

respect to II if V a,b<El ', V cG {0, 1} : a -< n c -< n b =^> c G /. 

Definition 8 (dissection protocol). Given a function f : {0, l} k x {0, l} k h- > 

{0, 1}' and permutations n 1 ,n 2 of {0, l} k , a protocol for f is a dissection 
protocol with respect to (n 1 ,n 2 ) if, at each communication step, the main- 
tained subset of inputs of each party \ is contiguous with respect to IL; . 
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Observe that every protocol P can be regarded as a dissection protocol 
with respect to some permutations over inputs by simply constructing the 
permutation so that it is consistent with the way P updates the maintained 
sets of inputs. However, not every protocol is a dissection protocol with 
respect to specific permutations. Consider, for example, the case that both 
Hi and n 2 are the permutation over {0, l} fe that orders the elements from 
lowest to highest binary values. Observe that a protocol that is a dissection 
protocol with respect to these permutations cannot ask questions of the form 
"Is your input odd or even?" , for these questions partition the space of inputs 
into non- contiguous subsets with respect to (ili,n 2 ). 

A special case of interest of the dissection protocol is the "bisection type" 
protocols that have been investigated in the literature in many contexts js), 
10 . 

Definition 9 (bisection, c-bisection and bounded-bisection protocols). For 

a constant c G [|, l) ; a dissection protocol with respect to the permutations 
(ili,n2) is called a c-bisection protocol provided at each communication step 
each party, partitions its input space of size z into two halves of size c z and 
(1 — c)z. A bisection protocol is simply a —bisection protocol. For an integer 
valued function g(k) such that < g(k) < k, bounded- bis ection g ^) is the 
protocol that runs a bisection protocol with g(k) bisection operations followed 
by a protocol (if necessary) in which each party, repeatedly partitions its input 
space into two halves one of which is of size exactly one. 

We next introduce the concept of tiling functions. 

Definition 10 (tiling and non-tiling functions). A function f : {0, l} k x 
{0, l} fc i — y {0,1}' is called a tiling function with respect to two permuta- 
tions (n 1 ,n 2 ) of {0, l} fc if the monochromatic regions in y4n 1) n 2 (/) form a 
tiling, and the number of monochromatic regions in this tiling is denote by 
Xj (n l5 n 2 ). Conversely, f is a non-tiling function if f is not a tiling function 
with respect to every pair of permutations (n 1; n 2 ) of {0, l} fc . 

For example, f{x u . . . , x k , y u . . . , y h ) = J2i =1 {%i + Vi) (mod 2) is a tiling 
function with respect to (n 1 ,Il 2 ) with ry(n 2 ,n 2 ) = 4, where each Ilj or- 
ders its inputs (zi, . . . , Zk) in increasing order of Zi (mod 2). Note that 
a function / that is tiling function with respect to permutations (n 1 ,Il 2 ) 
may not be a tiling function with respect to a different set of permutations 
(11^, Il 2 ); see Fig. [31 Also, a function / can be a tiling function with respect 
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Figure 2: A tiling function with respect 
to different permutation pairs (IIi,Il2) 
and (11^ , II2) inducing different numbers of 
monochromatic rectangles. 



ni ni 

Figure 3: Tilability depends on Hi 
and II2. 



to two distinct permutation pairs (IIi, n 2 ) and (!![, IT 2 ), and the number of 
monochromatic regions in the two cases differ; see Fig. |2j Thus, indeed we 
need 111 and II2 in the definition of tiling functions and 17. 

Extensions to Multi-party Computation. For the multi-party computation 
model involving d > 2 parties, the d-ary tiling function / has a permutation 
Ilj of {0, l} fc for each i th argument of / (or, equivalently for each partyj. 
A dissection protocol is generalized to a "round robin" dissection protocol 
in the following manner. In one "mega" round of communications, parties 
communicate in a fixed order, say party 1; party 2 , . . . , party d , and the mega 
round is repeated if necessary. Any communication by any party is made 
available to all the other parties. Thus, each communication of the dissection 
protocol partitions a rf-dimensional space by an appropriate set of (d — 1)- 
dimensional hyperplanes, where the missing dimension in the hyperplane 
correspond to the index of the party communicating. 

5. Two-party Dissection Protocol for Tiling Functions 

5.1. Boolean Tiling Functions 

Lemma 1. Any Boolean tiling function f: {0, l} k x {0, l} k 1— > {0,1} with 
respect to some two permutations (n 1 ,n 2 ) can be computed in a perfectly 
privacy-preserving manner by a dissection protocol with respect to the same 
permutations (n 1 ,Il 2 ). 
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Proof. For any m x n Boolean matrix A with rows 1 Q g+i 

and columns indexed by 1, 2, . . . , m and 1,2, ... ,n, 
respectively, let the notation A[ii,i 2 , ji, 32] denote 
the submatrix of A consisting of rows %\,%\ + 
1, . . . , %2 and columns + 1, . . . , 32- Assume * + 1 

m,n > 2 and suppose that the zeroes and ones 
in the matrix A form a tiling. We claim that 
there must exist an index % G {1, 2, . . . , m — 1} „. . „ 

L J _t igure 4: i his configuration 

such that the partition of A into the two sub- cannot happen m Case 2 
matrices A[l,z, l,n] and A[i + l,m, l,n] does not 
split any tile, or that there must exist an index 
j G {1, 2, . . . , n — 1} such that the partition of A 

into the two sub-matrices A[l,m, and A[l,m,j + l,n] does not split 
any tile. This claim, applied recursively on each submatrix of A, will prove 
Lemma [TJ 

We prove our claim by induction on n. The basis case of n = 2 follows 
trivially. Suppose that our claim is true for all n e {2, . . . , g} and consider 
the case of n — q + 1 . 

Case 1: there exists an index j e {1, 2, . . . , q — 1} such that the partition of 
A[l,m, l,q] into the two sub- matrices A[l,m, and A[l,m,j + l,q\ does 
not split any tile. Then, the same index j works for A[l, m, 1, q + 1] also. 

Case 2: there is no such index j as in Case 1 above, but there exists an 
index i G {1, 2, . . . , m — 1} such that the partition of A[l, m, 1, q] into the two 
submatrices A[l, i, 1, q] and A[i + 1, m, 1, q] does not split any tile. Suppose 
that the index i does split a tile in the partition l,q+ 1] and A[i + 

1, m, 1, q+ 1] of m, 1, g + 1]. Then, we must have the situation as shown 
in Fig. HI which shows that the zeroes and ones of A[l, m, 1, q + 1] do not 
form a tiling. □ 

Remark 1. As Fig. shows, the claim of LemmaU\is false if f outputs three 
values. 

5.2. Average and Worst Case Par for Non-Boolean Tiling Functions 

Let / : {0, l} fe x {0, l} k H- {0, 1}* be a given tiling function with respect 
to permutations (LTi, Ila). Neither the c-bisection nor the bounded-bisection 
protocol performs well in terms of average Par on arbitrary tiling functions; 
see Fig. |S]for an illustration. In this section, we show that any tiling function 



11 





number of 


average case 


protocol 


steps of 


Par for 




communication 


distribution D M 


c-bisection on f\ 


k/ log 2 i 


k 


(ce [1/2,1)) 






bounded-bisection 9 ( fc ) on f 2 


^(fc) + 2 fe -fW _ i 


g(k) + 2 fc ~sW- 1 - 1 


(i<g(k)<k) 







Figure 5: Functions fi and f 2 with r/ 1 (n 1 ,n 2 ) = ry 2 (n 1 ,n 2 ) = 2. The bisection-type 
protocols fail to achieve a good average-case Par on them. 



f admits a dissection protocol that has a small constant average case Par. 
Moreover, we show that this result cannot be extended to the case of worst- 
case Pars. 



5.2.1. Constant Average-case Par for Non-Boolean Functions 

Let D„ denote the uniform distribution over all input pairs. We define the 
notion of a c-approximate uniform distribution D~ c ; note that D~° = D„. 

Definition 11 (c-approximate uniform distribution). A c-approximate uni- 
form distribution D~ c is a distribution in which the probabilities of the input 
pairs are close to that for the uniform distribution as a linear function of c, 
namely 



max 

(x,y),(xi,yi)e{0,l} k x{0,l} k 



Pr [x&y] - Pr [x'&y'] 



< c2 



-2k 
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Theorem 1. 

(a) A tiling function f with respect to permutations (n 1 ,II 2 ) admits a dis- 
section protocol P with respect to the same permutations (IIi,n2) using at 
most 4 17 (III, II2) communication steps such that a D ~ c < 4 + 4c. 

(b) For all < c < 1, there exists a tiling function f : {0, l} 2 x {0, l} 2 !->■ 
{0, l} 4 such that, for any two permutations (ni,n 2 ) of {0, l} 2 , every dis- 
section protocol with respect to (III, n 2 ) using any number of communication 
steps has a D ~c > 5±£. 

Proof. Let S = {Si, S%, ... , S rf } be the set of 17 = r^(IIi, n 2 ) ideal monochro- 
matic rectangles in the tiling of / induced by the permutations (III, II 2 ) and 
consider a protocol P that is a dissection protocol with respect to (ITi, Il 2 ). 
Suppose that the ideal monochromatic rectangle Si G S has yi elements, and 
P partitions this rectangle into U rectangles S^i, . . . , S^ ti having z^i, . . . , z ittl 
elements, respectively. Then, using the definition of a Du it follows that 



Similarly, it follows that 

^ y- \^ \^ 1 + c Vi _ I 1 + c > Vi _ I 1 + c ) f i Vi 

a °u c ^ 2^ Z^Z^ 2 2k X z- ■ ~ ^ 2-^ 2 2k ~ 2 2k 

i=l j=l(x 1 ,x 2 )£S i j * J 1=1 j=l i=l 

A binary space partition (Bsp) for a collection of disjoint rectangles in 
the two-dimensional plane is defined as follows. The plane is divided into two 
parts by cutting rectangles with a line if necessary. The two resulting parts of 
the plane are divided recursively in a similar manner; the process continues 
until at most one fragment of the original rectangles remains in any part of 
the plane. This division process can be naturally represented as a binary tree 
(BsP-tree) where a node represents a part of the plane and stores the cut 
that splits the plane into two parts that its two children represent and each 
leaf of the BsP-tree represents the final partitioning of the plane by storing 
at most one fragment of an input rectangle; see Fig. [7] for an illustration. 
The size of a Bsp is the number of leaves in the BsP-tree. The following 
result is known. 




(x 1 ,x2)eUxU 




\R I (x 1 ,x 2 )\ 
\R p (x 1 ,x 2 )\ 
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Figure 6: Example for q d ~c > 2±£_ The 
tiles are shown by thick black lines. The 
numbers shown at each cell is the associated 
probability of that input. 
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Figure 8: Illustrations of the arguments in the proof of Theorem^ The dotted lines in 
(b) are shown for visual clarities only. 

Fact 1. [4] Assume that we have a set S of disjoint axis-parallel rectangles 
in the plane. Then, there is a Bsp of S such that every rectangle in S is 
partitioned into at most 4 rectangles^ 



(a) Consider the dissection protocol corresponding to the Bsp in Fact [TJ 



2 The stronger bounds by Berman, DasGupta and Muthukrishnan |2| apply to average 
number of fragments only. 
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Then, using maxjjtj} < 4 we get a D ~c < Y^i=i 4 ^gasr Vl = 4 (1 + c). Also, the 
number of communication steps in this protocol is the height of the BsP-tree, 
which is at most 4ry. 

(b) Consider the function / whose ideal monochromatic rectangles are shown 
in Fig. [6j Any correct protocol for computing / must partition at least one 
rectangle of two elements, giving 



5.2.2. Large Worst-case Par for Non-Boolean Functions 

Can one extend the results of the last section to show that every tiling 
function admits a dissection protocol that achieves a good Par even in the 
worst easel We answer this question in the negative by presenting a tiling 
function for which every dissection protocol has large worst-case Par. 

Theorem 2. Let k > be an even integer. Then, there exists a tiling 
function f : {0, l} k x {0, l} k i— > {0, l} 3 with respect to some two permutations 
(ni,n 2 ) such that, for any two permutations U[ and U' 2 of {0, l} fc ; every 
dissection protocol for f with respect to H' 2 ) has a worst > 2 k l 2 — 1. 

Proof. Recall the example in Fig. [6] that essentially showed that there ex- 
ists functions that cannot be computed in a perfectly private manner. Our 
construction of the function / is based on the tiling shown in Fig. We con- 
sider the specific permutations ili,ri2 over {0, l} fc that order the elements 
in {0, l} fc by binary value (from to 2 k — 1). We now use the construc- 
tion in Fig. [6] "recursively" to create a tiling of the input space. We first 
embed = 2 k ~ 1 — 1 instances of the construction in Figure [6] recur- 

sively within one another, as shown in Fig. E(a), leaving a 1 x 1 square 
at the center. The vertical level i and the horizontal level i rectangles 
have dimension 1 x (2 k — (2i — 1)) and (2 k — (2z — 1)) x 1, respectively, for 
i = 1, 2, . . . , 2 k ~ 1 — 1. We then partition each of the level 1 rectangle in 
Fig. Ufa) into two "nearly" equal-sized rectangles as shown in Fig. Mjo). Con- 
sider the function / such that the monochromatic rectangles of ^(111,!^) 
are the tilings in Fig. IH^b) (/ outputs a different outcome for each (mini- 
mal) rectangle in the figure). Clearly, / is a tiling function with respect to 




□ 
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(Ill, n 2 ) and, moreover, since every rectangle shares a side with no more than 
8 rectangles, at most 8 output values of / suffice. 

Let 11^, U' 2 be any two arbitrary permutations of {0, l} k and consider any 
dissection protocol P with respect to (11^, H' 2 )- Consider the first meaningful 
step in the execution of P and suppose that this step was executed by party 1 
(the case that the step was executed by party 2 is analogous). This step 
partitions the total input space S = {0, 1, 2, . . . , 2 k — 1} into two nonempty 
subsets, say I C S and I' = S\I such that G I. Let < i < 2 k — 1 be the 
least integer such that i & I but i + 1 ^ I; such an i must exist since both 
the sets are non-empty. Consider the rectangles A, B, C and D in Fig. [5(b). 
We have the following cases. 

Case 1: i < 2 k ~ 1 — 2 k l 2 . Observe that, for every such i, there exists a 
level i + 1 vertical rectangle of size 2 k — 2i — 1 that is partitioned into two 
rectangles, one of which is of size exactly 1. Thus, a wors t > 2 k — 2i + 1 > 

2 (fc/2)+l _l > 2 fc / 2 _ 1. 

Case 2: 2 k ~ 1 — 2 fc / 2 < i < 2 k ~ x — 1. Observe that, for every such value of i, 
rectangle A, which is of size 2 k ~ l , is partitioned into two rectangles, of which 
one is of size at most 2 k l 2 . Thus, in this case a worst > % 2 tjt > 2 k l 2 — 1. 

Case 3: 2 k ~ 1 — 1 < i < 2 k ~ 1 + 1. In this case, at least one of the rectangles 
B, C or D is partitioned into two parts one of which is of size at most 2 and 
thus a worst > £J=i > 2 k - 2 - \ > 2 fc /2 _ 1. 

Case 4: 2 k ~ l + 1 < i < 2 k - 2 k l 2 . Similar to Case 2. 

Case 5: i > 2 k - 2 k ' 2 . Similar to Case 1. □ 

6. Extensions of the Basic Two-party Setup 

6.1. Non-tiling Functions 

A natural extension of the class of tiling functions involves relaxing the 
constraint that each monochromatic region must be a rectangle. 

Definition 12 (5-tiling function). A function f : {0, l} k x {0, l} k {0, 1}' 

is a called a 5-tiling function with respect to permutations (ITi, n 2 ) of {0, l} k 
if each maximal monochromatic region of Au lt u 2 {f) ^ s an union of at most 5 
disjoint rectangles. 

For example, the function whose tiling is as shown in Fig. H] is a 2-tiling 
Boolean function. 
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Proposition 1. For any S -tiling function f with respect to (n 1 ,II 2 ) with r 
maximal monochromatic regions, there is a dissection protocol P with respect 
to (IIi, II2) using at most4r5 communication steps such thata D ~c < (4+4c) 5. 

Proof. We use the algorithm of Theorem [T] on the set of at most rS rectangles 
obtained by partitioning each monochromatic region into rectangles. Since 
each rectangle is partitioned at most 4 times, each maximal monochromatic 
region of Af(Hx, n 2 ) will be partitioned at most 45 times. □ 

6.2. Multi-party Computation 

How good is the average Par for a dissection protocol on a d- dimensional 
tiling function? For a general d, it is non-trivial to compute precise bounds 
because each party ^ has her/his own permutation IT; of the input, the tiles are 
boxes of full dimension and hyperplanes corresponding to each step of the 
dissection protocol is of dimension exactly d — 1. Nonetheless, we show that 
the average Par is very high for dissection protocols even for 3 parties and 
uniform distribution, thereby suggesting that this quantification of privacy 
may not provide good bounds for three or more parties. 




Figure 9: (not drawn to scale) (a) The tiling function in the proof of Lemma\M The 

non-trivial rectangles for dimensions 1, 2 and 3 are colored by black, dark gray and light 
gray, respectively; the trivial rectangles, each having a distinct value, cover the region 
colored magenta, (b) Rectangles (in light gray) corresponding to a hypothetically first 
meaningful step of the protocol. 
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Theorem 3 (large average Par for dissection protocols with 3 parties). 
There exists a tiling function f: {0, l} k x {0, l} k x {0, l} fc >->■ {0, l} 3fc such 
that, for any three permutations ITi, 112,113 of {0, l} k , every dissection pro- 
tocol with respect to (III, n 2 , n 3 ) must have a Du = f2 (2 fc ) . 

Proof. In the sequel, for convenience we refer to 3- dimensional hyper-rectangles 
simply by rectangles and refer to the arguments of function / via deci- 
mal equivalent of the corresponding binary numbers. The tiling function 
for this theorem is adopted from an example of the paper by Paterson 



and Yao [141 . |15| with appropriate modifications. The three arguments of 
/ are referred to as dimensions 1, 2 and 3, respectively. Define the vol- 
ume of a rectangle R = [xi,x[} x [a^,^] x [ X3 ' x 3] — {0, 1, . . . , 2 fc — l} 3 is 
Volume(-R) = max{0, Il 3 =1 (x- — Xi + 1)}. For convenience, let [*] denote the 
interval [0, 2 k — l] . We provide the tiling for the function /; see Fig. [9] for a 
graphical illustration (note that Fig. is not drawn to scale): 

• For each dimension, we have a set of G (2 2fc ) rectangles; we refer to 
these rectangles as non-trivial rectangles for this dimension. 

— For dimension 1, these rectangles are of the form [*] x [2y, 2y] x 
[2z, 2z\ for every integral value of < 2y, 2z < 2 k . 

— For dimension 2, these rectangles are of the form [2x, 2x] x [*] x 
[2z + 1, 2z + 1] for every integral value of < 2x, 2z + 1 < 2 k . 

— For dimension 3, these rectangles are of the form [2x + 1, 2x + 1] x 
[2y+l, 2y+l] x [*] for every integral value of < 2x+l, 2y+l < 2 k . 

• The remaining "trivial" rectangles are each of unit volume such that 
they together cover the remaining input space. 

Let iSnon-triviai be the set of all non-trivial rectangles. Observe that: 

• Rectangles in *S n0 n— trivial are mutually disjoint since any two of them do 
not intersect in at least one dimension. 

• Each rectangle in 5 n0 n-triviai has a volume of 2 k and thus the sum of 
their volumes is G (2 3/c ) . 

It now also follows that the number of monochromatic regions is O (2 3fc ) . 
Suppose that a dissection protocol partitions, for i = 1, 2, . . . , \ <S n on- trivial I > the 
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i th non-trivial rectangle Ri e *S n on— trivial into tj rectangles, say R it i, _R i)2 , . . . , Ri,ti- 
Then, 



a, 



I T~)I ( \ I l^non — triviall t% \ / I / T~t \ 

•m:^P^ } >- E EE-i^M^g 

(*,j/,z)e 1 v ' y ' ;| »=i j=i{x,y,z)eRi,j v jy 



{0,l} fc x{0,l} fe x{0,l} 

|*5non — trivial I I ^non- trivial I 

= E Ej* = E (*./ 22 ') 

2=1 J = l 2 = 1 

| ^non- trivial | 

Thus, it suffices to show that ^J^i = ^ (2 3fc ) . Let <2 be the set of maximal 

i=i 

monochromatic rectangles produced the partitioning of the entire protocol. 
Consider the two entries p x , y ,z = (2x + 1, 2y, 2z + 1) and p' xy z = (2x, 2y, 2z) 
(see Fig. [10]). Note that p x ,y,z belongs to a trivial rectangle since their 
third, first and second coordinate does not lie within any non-trivial rect- 
angle of dimension 1, 2 and 3, respectively, whereas p' xyz belongs to the 
non-trivial rectangle [*] x [2 x (8y),2 x (%)] x [2 x (8z),2 x (8z)] of di- 
mension 1. Thus, p x ,y,z and p^ xyz cannot belong to the same rectangle in 
Q. Let T = [J { {p 8x , 8 y,sz, P' 8x , 8y ,s z } I 64 < 16x, 16y, I6z < 2 k - 64 }. Clearly, 
\T\ = Q (2 3k ). For an entry (xi, x 2 , £3), let its neighborhood be defined by the 
ball Nbr(xi, x 2 , x 3 ) = { (x[, x' 2 , x' 3 ) | Vz : \xi — x' { \ < 4 }, i.e., the neighborhood 
of an entry is the set of all entries (x[, x' 2 , x' 3 ) such that each x\ lies in the range 
[xi - 4, Xi + 4] for % = 1, 2, 3. Note that Nbr(p 8:Ci%i82 ) n Nbr(p 8:rWi82 /) = 
provided (x,y,z) 7^ (x r ,y r ,z'). Next, we show that, to ensure that the two 
entries p 8x ,8j/,8^ an d p's x ,8 y ,8z are m two different rectangles in Q, the protocol 
must produce an additional fragment of one of the non-trivial rectangles in 
the neighborhood Hbr(p 8X) 8 y ,8z)', this would directly imply Y^t; = (2 3fc ). 

Consider the step of the protocol before which p 8x ,8 y ,8z and p' 8x ^ y ,8z were 
contained inside the same rectangle, namely a rectangle Q that includes the 
rectangle [16x, 16x + 1] x [16y, 16y] x [16z, 16z + 1], but after which they 
are in two different rectangles Q% = [a'l,^] x [a' 2 , b' 2 ] x [03,63] and Q 2 = 
[a 'I, b"] x [02,62] x [«3 , ^3 ] • Remember that both Q\ and Q 2 must have the 
same two dimensions and these two dimensions must be the same as the 
corresponding dimensions of Q. The following cases arise. 

Case 1 (split via the first coordinate): [a' 2 ,6 2 ] = [a 2 , b 2 ) ~2 [16y, 16y], 
[ a ' 3) fo 3 ] = [al,bl\ D [16z, 16 z + 1], b\ = I62 and a'[ = Wx + 1. Then, 
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a new fragment of a non-trivial rectangle of dimension 2 is produced at 
[16x, 16?/, 16z] G Nbr^s^.s*)- 



Case 2 (split via the second coordi- 
nate): [ai.fti] = «,&"] D [16x, 16z + 1] 
and [a'3,6' 3 ] = [ag, fig] D [16 z, 16* + 1]. This 
case is not possible. 



Case 3 (split 
nate): [a^fi^] = 



via the third coordi- 



K, b'{] 



D [16x,16x + 1], 
4,b^D[16y,16y},b' 3 = 16za,nd 
ag = 16z + 1. Then, a new fragment of a 
non-trivial rectangle of dimension 1 is pro- 



<"li u 2 



duced at [16a;, 16?/, 16z\ G Nbr(p 



Sx,8y,8zj 



□ 




p8x,8y,8z 



Figure 10: 

P8x,8y,Sz- 



Separating p S x,8y,8z from 



Remark 2. A generalized version of the ex- 
ample in d dimension can be used to provide 
a slightly improved lower bound on a Du for 

dissection protocols with more than three parties; the bound asymptotically 
approaches Cl (2 2k ) for large d. 



7. Analysis of the Bisection Protocol for Two Functions 

In Section 15.11 we showed that any Boolean tiling function can be com- 
puted with perfect privacy by a dissection protocol. In [8] the authors 
provided calculated bounds on a wors t and a Du for the bisection protocol, a 
special case of the general dissection protocol (see Definition [9J), on a few 



functions. In this section, we analyze the bisection protocol |9|, [10], for 
two Boolean functions that appear in the literature. As before, D u de- 
notes the uniform distribution. Letting x = (xi, x 2 , ■ ■ ■ , x n ) G {0, l} k and 
y = (yi, y 2 , • • • , y n ) G {0, l} fc , the functions that we consider are the follow- 
ing: 

set-covering: / A)V (x, y) = /\™ =1 (xi V?/j). To interpret this as a set-covering 
function, suppose that the universe U consists of n elements ei,e 2 , ■ ■ ■ ,e n 
and the vectors x and y encode membership of the elements in two sets 
S'x and S y , i.e., Xi (respectively, ?/j) is 1 if and only if G 5 X (respec- 
tively, Ci G S y ). Then, / A V (x, y) = 1 if and only if S x U S y = U. 
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i ! if V % \ x • — v ' 

equality: /=(x, y) = \ otherwise * ' ^ e ec l ua ^^ function provides a 



useful testbed for evaluating privacy preserving protocols, e.g., see |3|. 

As we already noted in Section [2j both of these functions are studied in 
the context of evaluating privacy preserving protocols and communication 
complexity settings 0, 11]. A summary of our bounds are as follows. 



A,V 



"worst > a Du > (|) 



2k 



Or 



2 + 2 



1-fc 



"worst 



- 2 



fc-i 



We will use the formula for a Du that we derived in the proof of Theorem [TJ 

letting r denote the number of monochromatic regions in an ideal partition 
of the function if, for i = 1,2, ... ,r, the i th monochromatic region contain 
Hi x 2 2k elements and the bisection protocol partitions this region into U>1 
rectangles containing z\, . . . , elements, respectively, then a Du = Y^i=i ^iVi- 
In the sequel, by "contribution of a rectangle (of the bisection protocol) to 
the (average Par)" we mean the size of the ideal monochromatic region that 
the rectangle is a part. 

7.1. Set Covering Function 
Theorem 4. a Du > (3/2) 2fe . 

Proof. We begin by showing the geometry of the tilings for small values of 
k which easily generalizes to larger k. The ideal tiling for / A)V is shown 
in Fig. [TTT a) for k = 3 with the value of the function for each input pair. 
The sizes of the ideal monochromatic partition are shown in Fig. [TTT b) for 
k = 1,2,3,4. The contributions to the average Par of various inputs after 
applying the bisection protocol are illustrated in Fig. [T2]for k = 1, 2, 3, 4. We 
observe the following: 

• The tiles colored light gray for the case when k = 4 are referred to as the 
"background tiles". For k = 1, 2, 3, 4 each such tile contributes 3, 9, 27 
and 81, respectively, to the average Par. In general, this contribution 
is given by 3 fc and all these tiles have size 1. 

• The contributions of the tiles in the upper-left region of the matrix are 
given by the sum of the first 2 k — 1 natural numbers; thus each of these 
tiles contribute 2 2k ~ 1 — 2 k ~ 1 . 
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• For any k, observe that the matrix can be decomposed into 4 quadrants; 
the following observations can be repeated recursively on each resulting 
quadrant, except for the first quadrant: 

— The first quadrant is a monochromatic region that contributes 
2 2fc-i _ 2 fc-i to the average Par. 

— The fourth quadrant has the same structure as the original matrix, 
but the contributions for the non-background tiles will be related 
to the case of a matrix with j bits instead of k, where the size of 
the quadrant is 2 J . For example, notice that the fourth quadrant 
of a matrix with k = 4 is the same as a whole matrix with k — 3, 
except for the "background tiles", that always contribute for 3 fc , 
with the original value of k. 

— The second and third quadrants are similar to the fourth quadrant 
case, but in this case the values in the upper-left portion of the 
quadrants will remain the same as the original matrix, instead of 
going down as with the fourth quadrant case. 



Figure 11: (a) Ideal monochromatic partition for / A)V when k = 3. (b) Sizes of ideal 
monochromatic partition for / A ,v- 

Based on these observations, we can obtain a recurrence for the total 
contribution to the average Par of all the tiles in a generic matrix. We need 
the following parameters: 




(a) 



(b) 
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Figure 12: Contribution to Par for k = 0, 1, 2, 3, 4. 



• The number of bits in the original matrix, that we denote by k; 

• The number of bits corresponding to the size of the matrix, or subma- 
trix being considered, that we denote by i; 

• The number of bits to be used in the calculation of the contribution of 
the upper-left portion of the matrix, or submatrix, being considered; 
we denote this by j. 

The recurrence that computes the total contribution to the PAR of all the 
tiles in the matrix is: 

f 3 fc , if i = 

9 [hJ, < 2 2j-i _ 2 j-i + 2g {i- l, j, k) + g(i - M - 1, k) , otherwise 
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The values of i and j are initially set to the value of k. The interpretation 
of each term in the above recurrence is as follows: 

• 3 k is the contribution of each "background tile" ; 

• 2 2j ~ 1 — 2 jf ~ 1 is the contribution of the first quadrant; 

• g (i — 1, j, k) is the contribution of each one of the second and third 
quadrants and 

• g (i — 1, i — 1, k) is the contribution of the fourth quadrant. 

Remember that, for a given k, the recurrence equation is initialized with 
i — j — k. Thus, we have: 

Case: k = 0: g (k, k, k) = 3 k = 3 2k . 

Case: k > 0: g(k, k, k) = g(k—l, k—1, k)+2g(k — l, k, k)+t(k). The second 
parameter to the function indicates how to generate the t(k) terms; the 
value of such terms is proportional to that parameter. Thus, for a > b, 
g(k,a,k) > g(k,b,k). For our lower bound, we can neglect the terms 
t(k). Thus, we obtain: 

g(k, k, k) > 3g(k - 1, jfc - 1, jfc) > 3g(k -2,k-2,k) 

> > 3^(1, 1, k) > 3g(0, 0, k) 

For each step, the value of the first parameter decreased exactly by one 
unit, so after k iterations the value of the first parameter will be zero. 
Hence we have g(k, k, k) > 3 k g(0, 0, k). Since g(0, 0, k) = 3 k we finally 
obtain g(k, k, k) >3 k x 3 k = 3 2k . 

Thus, a Du = g{k, k, k)/2 2k > (3/2) 2fc . □ 
7. 2. Equality function 

Theorem 5. a Du = 2 k - 2 + 2^ fc and a WOTSt = 2 2fc ~ 1 - 2 k -\ 

Proof. An illustration of the ideal partition into monochromatic regions for 
equality function is shown in Fig. [TBTa) . After running the bisection protocol, 
the induced tiling is (for k = 3) is shown in Fig. ITBTb). Excluding the 
diagonal, we have 2 tiles of size 16, 4 tiles of size 4, and 8 tiles of size 1. In 
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Figure 13: (a) Ideal tiling for equality function, (b) The induced tiling by the bisection 
protocol (shown for k = 3). (c) Contribution of each rectangle in protocol- induced tiling 
where * = 2 2fe_1 — 2 fe_1 . The numbers in the figure denote the size of each tile. 



general, it is easy to observe that, for each < i < k, we have exactly 2 k ~ l 
tiles of size 2 2 \ 

The following accounting scheme can be used to simplify calculation. For 



over each element 



uniform distribution D n , a Du is the sum of the ratio ppWj) 
(i, j) in the matrix divided by the number of total elements 2 2fc in the matrix, 
where R ! (i, j) and R p (i,j) is the size of the ideal and protocol-induced tiling 
that contains the cell (i, j). Consider a rectangle A of size m in the protocol- 
induced tiling and suppose that A is contained in a monochromatic region of 
the ideal partition of size m' . Then, the sum of contributions of the elements 



of A is £"\ ^ 



m 



Thus, the total contribution of the rectangle A is 



simply the size of region of the ideal partition containing it. 

Fig. [131(c) illustrates the contribution of each rectangle in the protocol- 
induced tiling to average Par. We can calculate the total contribution 
to the average Par of all the tiles in the matrix, except the diagonal, by 
multiplying 2 2fc_1 — 2 fc ~ 1 by the number of tiles. The number of tiles is 
given by: ^ k ~ % = % k+1 — 2. The total contribution of those tiles is 



(2 



fc+i 



=o 

}2fe-l 



onal is 1 



2) x (2 2 

1 + 

2 k times 



ife-i 



) 



= 2 3k 
2 k 



2 2k+1 + 2 k . The contribution of the diag- 
Since the average objective PAR a Du is the 



sum of the total contributions divided by the number of cells in the matrix, 
we have 



)3fc 



2 2fc+l +2 k + 2 k 

o2fc 



)3fe 



2%k+i _|_ 2 fc + 1 
2 2fc 



2 + 2 1 ' 



It can be seen from the ideal and protocol tilings that the worst case for Par 
is the one in which the ideal tile size is 2 2fc_1 — 2 fc_1 , and the protocol tile 
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size is 1. Thus a worst = 2 2k - 1 - 2 k ~ 1 . □ 
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